XP home-windows explorer malfunction

[j0ckser]

I hope this issue is sufficiently generic to transcend the XP Pro/XP Home boundary.

o/s=XP home SP2
HDD partitioned with o/s in C: and other programs/my documents in D:

Recently, odd happenings with windows explorer. Every time I open explorer (e.g., my documents, recycle bin) it freezes my computer. I have two options: reboot or open Task Manager and <End Process> for drwatson32.exe.

Initially error messages would show up, but no longer. If I open an app, then find a file to work with, there is no problem.

I have tried to remember if I did anything unusual to precipitate this, but nothing comes to mind.

per ardua ad astra

 

[wahnula]

Disable drwatson:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;188296

This may be a result of spyware/malware infection.

Tony

Users helping Users...

 

[wahnula]

A little research that I did states that drwatson32.exe is a Trojan...run the following scanners:

Adaware
Spybot S&D
Trend Micro's online HouseCall
AVG A/S
A-Squared Free
SUPERAntiSpyware

Most of these are available at

http://www.download.com,

HouseCall is available at

http://housecall.trendmicro.com/

Tony

Users helping Users...

 

[j0ckser]

thank you tony (wahnula)

i appreciate your research, but saying "drwatson is a trojan" doesn't make sense; it is part of the o/s package and apparently has been for many iterations of windows.

on the other hand, saying it may be infected with a virus/malware does make considerable sense and i have just run an AdAware scan, but no hits for that issue. i will run an antivirus scan shortly and will advise. in the meantime i'll disable the offender and find out difference that makes.

jock

per ardua ad astra

 

[JockMullin]

Hi, Jock

The parts of the OS are DRWATSON.EXE and DRWTSN32.EXE

There is indeed a trojan around called DRWATSON32.EXE, as Tony says.

Jock

"I know I'm God because when I pray I find I'm talking to myself" - Peter Sellers

 

[wahnula]

That's the subterfuge...like the viruses calling themselves "svchost32.exe" in the hopes that you'll think it part of the OS. Symantec talks about it here

Tony

Users helping Users...

 

[j0ckser]

just reviewed my virus scan and no hits.

now i have disabled dr watson. and so far so good.

why the problem and why now? any takers?



per ardua ad astra

 

[linney]

Why were you infected, there could be several reasons?

Basically your security, both programs and user behavior, has fallen down and allowed an infection to pass through your defenses.

How many users are on your computer besides you? Do you know their surfing habits? Are your users using an Administrative account rather than, the less damaging in case of problems caused by malware, Limited User account?
With Administrative privileges anything which gets into your machine can do whatever it likes, but if you are only a Limited User then any damage is limited too.

Programs like virus scanners only mainly concentrate on viruses (and some more common worms and Trojans), but that still leaves many worms and Trojans as a danger. Which is why many people have what is loosely termed a "layered approach", where you have specific programs for specific threat attacks. You can spend lots of money preventing the chances of infection but the biggest danger is from sloppy user control.

Another thing to watch out for is portable media such as DVD's, CD's or USB, shared and inserted by friends from other less controlled machines.

No matter how good your virus scanner is, unless it knows about an infection threat (updated definitions) it will not detect it, although many have heuristic detection to advice of a possible infection or suspicious file, which produces as many false positives as it does positives.

To help your virus scanner manufacturer/programmer you could send them a copy of the infected DRWATSON32.EXE, via a zipped file and E-mail so that they may better handle it in the future.

 

[wahnula]

Great answer linney. And here I thought your vocabulary was limited to links

j0ckser,

Keep running scans, make sure System Restore is turned off as recommended by Symantec. Try every approved free scanner you can...but be warned, not all malware removal programs are what they say they are. Stick to the proven ones and you should be fine.

Tony

Users helping Users...

 

[linney]

I am known as "Linney the Link", it's just my style and I'm too old to change my ways now. I am still searching for the "missing link", you know, the one that will solve all the problems in one great link!

 

[wahnula]

I am known as "Linney the Link"

Oh, and that one great link???

http://www.tek-tips.com

j0ckser,

Any news to report?


Tony

Users helping Users...

 

[j0ckser]

news

with drwatson disabled, i now get the real story.

Instruction @ "0x0199415b" referenced memory @ "0x00000000". The memory could not be "written".
Click ok to terminate the program.

this always happens when i'm in the recycle bin (i'm trying to restore a file), but often happens at other times when i use windows explorer in any way (e.g., my computer).

while the initial "instruction @" address varies, the attempt to reference 0x00000000 is always the same. closing explorer "seems" to have no affect on other programs.

something else i'll do is scan my D: partition for malware and viruses.


per ardua ad astra

 

[linney]

Have you tried the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

To get further information about any error look in your Event viewer.
Look in the System or Application folder. You can get to the Event Viewer via right click My Computer icon and select Manage.

Any errors logged in the Event Viewer can be expanded by double clicking on the error line.

http://www.google.com/search?source...-8&q="memory+could+not+be+written"+windows+xp

http://groups.google.com/groups?sou...-8&q="memory+could+not+be+written"+windows+xp

 

[j0ckser]

i think i have narrowed the problem down. something in one of the links linney provided gave me a clue. the only time i have a problem is when i open a folder with .avi files in it.

a while ago i was offered a upgraded version of DIVX player. ever since then i have had problems.

any ideas? please?

per ardua ad astra

 

[linney]

These refer to a problem specific to AVI files, I haven't seen much problems with it lately, so I thought later updates had fixed the problem.

822430 - Windows Stops Responding When You Click a Large AVI File in Windows Explorer

http://support.microsoft.com/default.aspx?scid=kb;en-us;822430&FR=1&PA=1&SD=HSCH

There is a bug in XP in handling AVI files, where the file is corrupt or broken, causing explorer to read the whole file looking for index or property details.

It has been suggested to correct this misbehavior in Windows XP, remove the following registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D62D94-71B3-4b9a-9489-5FE6850DC73E}\InProcServer32

This will prevent Explorer from loading shmedia.dll in response to file property queries on these files.



Also try these.

A suggested workaround: Go to Start/Run/Regedit and navigate to
the key below and delete the default data (right pane).

For AVI's

HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\
shellex\PropertyHandler

For MP3's

HKEY_CLASSES_ROOT\SystemFileAssociations\.mp3\shellex\PropertyHandler

Note: Make a backup of each key before editing.


Have a look around these links.

http://www.winxptutor.com/sp2/divxcrash.htm

Select a file - windows stops.
Thread779-422825



This one specifically targets DivX problems

FREEZE or Application hang - near 98%
thread779-896179